Analysis
-
max time kernel
204s -
max time network
199s -
platform
windows10-2004_x64 -
resource
win10v2004-en-20220113 -
submitted
15-03-2022 19:21
Behavioral task
behavioral1
Sample
1d6463170b7e71234a1fe0ddde27dff4285c45a8b11b57061c78639092154713.exe
Resource
win7-20220311-en
Behavioral task
behavioral2
Sample
1d6463170b7e71234a1fe0ddde27dff4285c45a8b11b57061c78639092154713.exe
Resource
win10v2004-en-20220113
General
-
Target
1d6463170b7e71234a1fe0ddde27dff4285c45a8b11b57061c78639092154713.exe
-
Size
575KB
-
MD5
28527433b0bd73c50a6a6921e1053124
-
SHA1
7a89b07d4e695a4745ad6732e5a4a14eeba85cff
-
SHA256
1d6463170b7e71234a1fe0ddde27dff4285c45a8b11b57061c78639092154713
-
SHA512
f5b2a51c9271dd42aa52c68d77c9558cc02241ef6a022dbd56ed28dd08e801733ec50917424fd4c8568553508f4e1abfa0dcc1032d9e424c4bab589950253d66
Malware Config
Signatures
-
Dharma
Dharma is a ransomware that uses security software installation to hide malicious activities.
-
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Drops startup file 1 IoCs
Processes:
1d6463170b7e71234a1fe0ddde27dff4285c45a8b11b57061c78639092154713.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\1d6463170b7e71234a1fe0ddde27dff4285c45a8b11b57061c78639092154713.exe 1d6463170b7e71234a1fe0ddde27dff4285c45a8b11b57061c78639092154713.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
1d6463170b7e71234a1fe0ddde27dff4285c45a8b11b57061c78639092154713.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\1d6463170b7e71234a1fe0ddde27dff4285c45a8b11b57061c78639092154713.exe = "C:\\Windows\\System32\\1d6463170b7e71234a1fe0ddde27dff4285c45a8b11b57061c78639092154713.exe" 1d6463170b7e71234a1fe0ddde27dff4285c45a8b11b57061c78639092154713.exe -
Drops desktop.ini file(s) 3 IoCs
Processes:
1d6463170b7e71234a1fe0ddde27dff4285c45a8b11b57061c78639092154713.exedescription ioc process File opened for modification C:\$Recycle.Bin\S-1-5-21-1346565761-3498240568-4147300184-1000\desktop.ini 1d6463170b7e71234a1fe0ddde27dff4285c45a8b11b57061c78639092154713.exe File opened for modification C:\Program Files\desktop.ini 1d6463170b7e71234a1fe0ddde27dff4285c45a8b11b57061c78639092154713.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\DataServices\DESKTOP.INI 1d6463170b7e71234a1fe0ddde27dff4285c45a8b11b57061c78639092154713.exe -
Drops file in System32 directory 1 IoCs
Processes:
1d6463170b7e71234a1fe0ddde27dff4285c45a8b11b57061c78639092154713.exedescription ioc process File created C:\Windows\System32\1d6463170b7e71234a1fe0ddde27dff4285c45a8b11b57061c78639092154713.exe 1d6463170b7e71234a1fe0ddde27dff4285c45a8b11b57061c78639092154713.exe -
Drops file in Program Files directory 64 IoCs
Processes:
1d6463170b7e71234a1fe0ddde27dff4285c45a8b11b57061c78639092154713.exedescription ioc process File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-private-l1-1-0.dll.id-09D8770D.[[email protected]].ROGER 1d6463170b7e71234a1fe0ddde27dff4285c45a8b11b57061c78639092154713.exe File created C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\org.eclipse.rcp_4.4.0.v20141007-2301\feature.xml.id-09D8770D.[[email protected]].ROGER 1d6463170b7e71234a1fe0ddde27dff4285c45a8b11b57061c78639092154713.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\olh001.htm 1d6463170b7e71234a1fe0ddde27dff4285c45a8b11b57061c78639092154713.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\lib\deploy\messages_ja.properties 1d6463170b7e71234a1fe0ddde27dff4285c45a8b11b57061c78639092154713.exe File opened for modification C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe 1d6463170b7e71234a1fe0ddde27dff4285c45a8b11b57061c78639092154713.exe File opened for modification C:\Program Files\Common Files\System\msadc\ja-JP\msdaprsr.dll.mui 1d6463170b7e71234a1fe0ddde27dff4285c45a8b11b57061c78639092154713.exe File opened for modification C:\Program Files\Google\Chrome\Application\89.0.4389.114\Locales\fi.pak.id-09D8770D.[[email protected]].ROGER 1d6463170b7e71234a1fe0ddde27dff4285c45a8b11b57061c78639092154713.exe File opened for modification C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0090-0000-1000-0000000FF1CE.xml.id-09D8770D.[[email protected]].ROGER 1d6463170b7e71234a1fe0ddde27dff4285c45a8b11b57061c78639092154713.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-private-l1-1-0.dll 1d6463170b7e71234a1fe0ddde27dff4285c45a8b11b57061c78639092154713.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-runtime-l1-1-0.dll.id-09D8770D.[[email protected]].ROGER 1d6463170b7e71234a1fe0ddde27dff4285c45a8b11b57061c78639092154713.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\images\macGrey.png.id-09D8770D.[[email protected]].ROGER 1d6463170b7e71234a1fe0ddde27dff4285c45a8b11b57061c78639092154713.exe File created C:\Program Files\Google\Chrome\Application\89.0.4389.114\default_apps\docs.crx.id-09D8770D.[[email protected]].ROGER 1d6463170b7e71234a1fe0ddde27dff4285c45a8b11b57061c78639092154713.exe File created C:\Program Files\Java\jdk1.8.0_66\jre\lib\deploy\messages_zh_TW.properties.id-09D8770D.[[email protected]].ROGER 1d6463170b7e71234a1fe0ddde27dff4285c45a8b11b57061c78639092154713.exe File opened for modification C:\Program Files\7-Zip\Lang\cs.txt.id-09D8770D.[[email protected]].ROGER 1d6463170b7e71234a1fe0ddde27dff4285c45a8b11b57061c78639092154713.exe File opened for modification C:\Program Files\7-Zip\Lang\sl.txt.id-09D8770D.[[email protected]].ROGER 1d6463170b7e71234a1fe0ddde27dff4285c45a8b11b57061c78639092154713.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVScripting.dll.id-09D8770D.[[email protected]].ROGER 1d6463170b7e71234a1fe0ddde27dff4285c45a8b11b57061c78639092154713.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\config\ModuleAutoDeps\org-openide-filesystems.xml 1d6463170b7e71234a1fe0ddde27dff4285c45a8b11b57061c78639092154713.exe File created C:\Program Files\Java\jdk1.8.0_66\COPYRIGHT.id-09D8770D.[[email protected]].ROGER 1d6463170b7e71234a1fe0ddde27dff4285c45a8b11b57061c78639092154713.exe File created C:\Program Files\Java\jdk1.8.0_66\THIRDPARTYLICENSEREADME.txt.id-09D8770D.[[email protected]].ROGER 1d6463170b7e71234a1fe0ddde27dff4285c45a8b11b57061c78639092154713.exe File created C:\Program Files\Microsoft Office\root\fre\StartMenu_Win10_RTL.mp4.id-09D8770D.[[email protected]].ROGER 1d6463170b7e71234a1fe0ddde27dff4285c45a8b11b57061c78639092154713.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.apache.commons.logging_1.1.1.v201101211721.jar.id-09D8770D.[[email protected]].ROGER 1d6463170b7e71234a1fe0ddde27dff4285c45a8b11b57061c78639092154713.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\include\jvmticmlr.h 1d6463170b7e71234a1fe0ddde27dff4285c45a8b11b57061c78639092154713.exe File opened for modification C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0018-0000-1000-0000000FF1CE.xml.id-09D8770D.[[email protected]].ROGER 1d6463170b7e71234a1fe0ddde27dff4285c45a8b11b57061c78639092154713.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\bin\orbd.exe.id-09D8770D.[[email protected]].ROGER 1d6463170b7e71234a1fe0ddde27dff4285c45a8b11b57061c78639092154713.exe File created C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\Arial.xml.id-09D8770D.[[email protected]].ROGER 1d6463170b7e71234a1fe0ddde27dff4285c45a8b11b57061c78639092154713.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\lib\jfr.jar.id-09D8770D.[[email protected]].ROGER 1d6463170b7e71234a1fe0ddde27dff4285c45a8b11b57061c78639092154713.exe File opened for modification C:\Program Files\Microsoft Office\root\Integration\C2RManifest.powerpointmui.msi.16.en-us.xml 1d6463170b7e71234a1fe0ddde27dff4285c45a8b11b57061c78639092154713.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\ClientVolumeLicense_eula.txt.id-09D8770D.[[email protected]].ROGER 1d6463170b7e71234a1fe0ddde27dff4285c45a8b11b57061c78639092154713.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\org.eclipse.emf.ecore_2.10.1.v20140901-1043\license.html 1d6463170b7e71234a1fe0ddde27dff4285c45a8b11b57061c78639092154713.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\config\Modules\org-netbeans-modules-keyring-impl.xml 1d6463170b7e71234a1fe0ddde27dff4285c45a8b11b57061c78639092154713.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\update_tracking\org-netbeans-modules-options-api.xml.id-09D8770D.[[email protected]].ROGER 1d6463170b7e71234a1fe0ddde27dff4285c45a8b11b57061c78639092154713.exe File created C:\Program Files\Java\jdk1.8.0_66\jre\bin\dt_socket.dll.id-09D8770D.[[email protected]].ROGER 1d6463170b7e71234a1fe0ddde27dff4285c45a8b11b57061c78639092154713.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\schema\com.jrockit.mc.rjmx.attributeTransformation.exsd.id-09D8770D.[[email protected]].ROGER 1d6463170b7e71234a1fe0ddde27dff4285c45a8b11b57061c78639092154713.exe File created C:\Program Files\Java\jdk1.8.0_66\jre\lib\cmm\LINEAR_RGB.pf.id-09D8770D.[[email protected]].ROGER 1d6463170b7e71234a1fe0ddde27dff4285c45a8b11b57061c78639092154713.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\DataServices\+Connect to New Data Source.odc.id-09D8770D.[[email protected]].ROGER 1d6463170b7e71234a1fe0ddde27dff4285c45a8b11b57061c78639092154713.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVManifest.dll 1d6463170b7e71234a1fe0ddde27dff4285c45a8b11b57061c78639092154713.exe File created C:\Program Files\Java\jdk1.8.0_66\jre\lib\images\cursors\win32_MoveDrop32x32.gif.id-09D8770D.[[email protected]].ROGER 1d6463170b7e71234a1fe0ddde27dff4285c45a8b11b57061c78639092154713.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\gifs\rarrow.gif 1d6463170b7e71234a1fe0ddde27dff4285c45a8b11b57061c78639092154713.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\html\cpyr.htm 1d6463170b7e71234a1fe0ddde27dff4285c45a8b11b57061c78639092154713.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\bin\ssvagent.exe.id-09D8770D.[[email protected]].ROGER 1d6463170b7e71234a1fe0ddde27dff4285c45a8b11b57061c78639092154713.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\lib\amd64\jvm.cfg 1d6463170b7e71234a1fe0ddde27dff4285c45a8b11b57061c78639092154713.exe File created C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\Times New Roman-Arial.xml.id-09D8770D.[[email protected]].ROGER 1d6463170b7e71234a1fe0ddde27dff4285c45a8b11b57061c78639092154713.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.ja_5.5.0.165303.jar.id-09D8770D.[[email protected]].ROGER 1d6463170b7e71234a1fe0ddde27dff4285c45a8b11b57061c78639092154713.exe File created C:\Program Files\7-Zip\Uninstall.exe.id-09D8770D.[[email protected]].ROGER 1d6463170b7e71234a1fe0ddde27dff4285c45a8b11b57061c78639092154713.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\update_tracking\org-netbeans-modules-queries.xml.id-09D8770D.[[email protected]].ROGER 1d6463170b7e71234a1fe0ddde27dff4285c45a8b11b57061c78639092154713.exe File created C:\Program Files\Java\jdk1.8.0_66\jre\bin\eula.dll.id-09D8770D.[[email protected]].ROGER 1d6463170b7e71234a1fe0ddde27dff4285c45a8b11b57061c78639092154713.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\it-IT\tabskb.dll.mui 1d6463170b7e71234a1fe0ddde27dff4285c45a8b11b57061c78639092154713.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\profiler\config\Modules\org-netbeans-modules-profiler-heapwalker.xml.id-09D8770D.[[email protected]].ROGER 1d6463170b7e71234a1fe0ddde27dff4285c45a8b11b57061c78639092154713.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-multibyte-l1-1-0.dll.id-09D8770D.[[email protected]].ROGER 1d6463170b7e71234a1fe0ddde27dff4285c45a8b11b57061c78639092154713.exe File opened for modification C:\Program Files\Common Files\System\Ole DB\it-IT\oledb32r.dll.mui 1d6463170b7e71234a1fe0ddde27dff4285c45a8b11b57061c78639092154713.exe File created C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\config\Modules\org-netbeans-core-io-ui.xml.id-09D8770D.[[email protected]].ROGER 1d6463170b7e71234a1fe0ddde27dff4285c45a8b11b57061c78639092154713.exe File created C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\profiler\config\Modules\org-netbeans-modules-profiler-selector-api.xml.id-09D8770D.[[email protected]].ROGER 1d6463170b7e71234a1fe0ddde27dff4285c45a8b11b57061c78639092154713.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\lib\jfxswt.jar.id-09D8770D.[[email protected]].ROGER 1d6463170b7e71234a1fe0ddde27dff4285c45a8b11b57061c78639092154713.exe File opened for modification C:\Program Files\Microsoft Office\root\Integration\C2RManifest.dcfmui.msi.16.en-us.xml 1d6463170b7e71234a1fe0ddde27dff4285c45a8b11b57061c78639092154713.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\en-GB\tipresx.dll.mui 1d6463170b7e71234a1fe0ddde27dff4285c45a8b11b57061c78639092154713.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\sr-Latn-RS\tipresx.dll.mui 1d6463170b7e71234a1fe0ddde27dff4285c45a8b11b57061c78639092154713.exe File opened for modification C:\Program Files\Google\Chrome\Application\89.0.4389.114\resources.pak.id-09D8770D.[[email protected]].ROGER 1d6463170b7e71234a1fe0ddde27dff4285c45a8b11b57061c78639092154713.exe File created C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-001F-0409-1000-0000000FF1CE.xml.id-09D8770D.[[email protected]].ROGER 1d6463170b7e71234a1fe0ddde27dff4285c45a8b11b57061c78639092154713.exe File created C:\Program Files\Microsoft Office\root\Document Themes 16\Gallery.thmx.id-09D8770D.[[email protected]].ROGER 1d6463170b7e71234a1fe0ddde27dff4285c45a8b11b57061c78639092154713.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\update_tracking\org-openide-compat.xml.id-09D8770D.[[email protected]].ROGER 1d6463170b7e71234a1fe0ddde27dff4285c45a8b11b57061c78639092154713.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\bin\javacpl.cpl.id-09D8770D.[[email protected]].ROGER 1d6463170b7e71234a1fe0ddde27dff4285c45a8b11b57061c78639092154713.exe File opened for modification C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\Georgia.xml 1d6463170b7e71234a1fe0ddde27dff4285c45a8b11b57061c78639092154713.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\QuickStyles\linesdistinctive.dotx 1d6463170b7e71234a1fe0ddde27dff4285c45a8b11b57061c78639092154713.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\Bibliography\Sort\YEAR.XSL.id-09D8770D.[[email protected]].ROGER 1d6463170b7e71234a1fe0ddde27dff4285c45a8b11b57061c78639092154713.exe -
Interacts with shadow copies 2 TTPs 1 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
Processes:
vssadmin.exepid process 4244 vssadmin.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
1d6463170b7e71234a1fe0ddde27dff4285c45a8b11b57061c78639092154713.exepid process 2680 1d6463170b7e71234a1fe0ddde27dff4285c45a8b11b57061c78639092154713.exe 2680 1d6463170b7e71234a1fe0ddde27dff4285c45a8b11b57061c78639092154713.exe 2680 1d6463170b7e71234a1fe0ddde27dff4285c45a8b11b57061c78639092154713.exe 2680 1d6463170b7e71234a1fe0ddde27dff4285c45a8b11b57061c78639092154713.exe 2680 1d6463170b7e71234a1fe0ddde27dff4285c45a8b11b57061c78639092154713.exe 2680 1d6463170b7e71234a1fe0ddde27dff4285c45a8b11b57061c78639092154713.exe 2680 1d6463170b7e71234a1fe0ddde27dff4285c45a8b11b57061c78639092154713.exe 2680 1d6463170b7e71234a1fe0ddde27dff4285c45a8b11b57061c78639092154713.exe 2680 1d6463170b7e71234a1fe0ddde27dff4285c45a8b11b57061c78639092154713.exe 2680 1d6463170b7e71234a1fe0ddde27dff4285c45a8b11b57061c78639092154713.exe 2680 1d6463170b7e71234a1fe0ddde27dff4285c45a8b11b57061c78639092154713.exe 2680 1d6463170b7e71234a1fe0ddde27dff4285c45a8b11b57061c78639092154713.exe 2680 1d6463170b7e71234a1fe0ddde27dff4285c45a8b11b57061c78639092154713.exe 2680 1d6463170b7e71234a1fe0ddde27dff4285c45a8b11b57061c78639092154713.exe 2680 1d6463170b7e71234a1fe0ddde27dff4285c45a8b11b57061c78639092154713.exe 2680 1d6463170b7e71234a1fe0ddde27dff4285c45a8b11b57061c78639092154713.exe 2680 1d6463170b7e71234a1fe0ddde27dff4285c45a8b11b57061c78639092154713.exe 2680 1d6463170b7e71234a1fe0ddde27dff4285c45a8b11b57061c78639092154713.exe 2680 1d6463170b7e71234a1fe0ddde27dff4285c45a8b11b57061c78639092154713.exe 2680 1d6463170b7e71234a1fe0ddde27dff4285c45a8b11b57061c78639092154713.exe 2680 1d6463170b7e71234a1fe0ddde27dff4285c45a8b11b57061c78639092154713.exe 2680 1d6463170b7e71234a1fe0ddde27dff4285c45a8b11b57061c78639092154713.exe 2680 1d6463170b7e71234a1fe0ddde27dff4285c45a8b11b57061c78639092154713.exe 2680 1d6463170b7e71234a1fe0ddde27dff4285c45a8b11b57061c78639092154713.exe 2680 1d6463170b7e71234a1fe0ddde27dff4285c45a8b11b57061c78639092154713.exe 2680 1d6463170b7e71234a1fe0ddde27dff4285c45a8b11b57061c78639092154713.exe 2680 1d6463170b7e71234a1fe0ddde27dff4285c45a8b11b57061c78639092154713.exe 2680 1d6463170b7e71234a1fe0ddde27dff4285c45a8b11b57061c78639092154713.exe 2680 1d6463170b7e71234a1fe0ddde27dff4285c45a8b11b57061c78639092154713.exe 2680 1d6463170b7e71234a1fe0ddde27dff4285c45a8b11b57061c78639092154713.exe 2680 1d6463170b7e71234a1fe0ddde27dff4285c45a8b11b57061c78639092154713.exe 2680 1d6463170b7e71234a1fe0ddde27dff4285c45a8b11b57061c78639092154713.exe 2680 1d6463170b7e71234a1fe0ddde27dff4285c45a8b11b57061c78639092154713.exe 2680 1d6463170b7e71234a1fe0ddde27dff4285c45a8b11b57061c78639092154713.exe 2680 1d6463170b7e71234a1fe0ddde27dff4285c45a8b11b57061c78639092154713.exe 2680 1d6463170b7e71234a1fe0ddde27dff4285c45a8b11b57061c78639092154713.exe 2680 1d6463170b7e71234a1fe0ddde27dff4285c45a8b11b57061c78639092154713.exe 2680 1d6463170b7e71234a1fe0ddde27dff4285c45a8b11b57061c78639092154713.exe 2680 1d6463170b7e71234a1fe0ddde27dff4285c45a8b11b57061c78639092154713.exe 2680 1d6463170b7e71234a1fe0ddde27dff4285c45a8b11b57061c78639092154713.exe 2680 1d6463170b7e71234a1fe0ddde27dff4285c45a8b11b57061c78639092154713.exe 2680 1d6463170b7e71234a1fe0ddde27dff4285c45a8b11b57061c78639092154713.exe 2680 1d6463170b7e71234a1fe0ddde27dff4285c45a8b11b57061c78639092154713.exe 2680 1d6463170b7e71234a1fe0ddde27dff4285c45a8b11b57061c78639092154713.exe 2680 1d6463170b7e71234a1fe0ddde27dff4285c45a8b11b57061c78639092154713.exe 2680 1d6463170b7e71234a1fe0ddde27dff4285c45a8b11b57061c78639092154713.exe 2680 1d6463170b7e71234a1fe0ddde27dff4285c45a8b11b57061c78639092154713.exe 2680 1d6463170b7e71234a1fe0ddde27dff4285c45a8b11b57061c78639092154713.exe 2680 1d6463170b7e71234a1fe0ddde27dff4285c45a8b11b57061c78639092154713.exe 2680 1d6463170b7e71234a1fe0ddde27dff4285c45a8b11b57061c78639092154713.exe 2680 1d6463170b7e71234a1fe0ddde27dff4285c45a8b11b57061c78639092154713.exe 2680 1d6463170b7e71234a1fe0ddde27dff4285c45a8b11b57061c78639092154713.exe 2680 1d6463170b7e71234a1fe0ddde27dff4285c45a8b11b57061c78639092154713.exe 2680 1d6463170b7e71234a1fe0ddde27dff4285c45a8b11b57061c78639092154713.exe 2680 1d6463170b7e71234a1fe0ddde27dff4285c45a8b11b57061c78639092154713.exe 2680 1d6463170b7e71234a1fe0ddde27dff4285c45a8b11b57061c78639092154713.exe 2680 1d6463170b7e71234a1fe0ddde27dff4285c45a8b11b57061c78639092154713.exe 2680 1d6463170b7e71234a1fe0ddde27dff4285c45a8b11b57061c78639092154713.exe 2680 1d6463170b7e71234a1fe0ddde27dff4285c45a8b11b57061c78639092154713.exe 2680 1d6463170b7e71234a1fe0ddde27dff4285c45a8b11b57061c78639092154713.exe 2680 1d6463170b7e71234a1fe0ddde27dff4285c45a8b11b57061c78639092154713.exe 2680 1d6463170b7e71234a1fe0ddde27dff4285c45a8b11b57061c78639092154713.exe 2680 1d6463170b7e71234a1fe0ddde27dff4285c45a8b11b57061c78639092154713.exe 2680 1d6463170b7e71234a1fe0ddde27dff4285c45a8b11b57061c78639092154713.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
vssvc.exedescription pid process Token: SeBackupPrivilege 4212 vssvc.exe Token: SeRestorePrivilege 4212 vssvc.exe Token: SeAuditPrivilege 4212 vssvc.exe -
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
1d6463170b7e71234a1fe0ddde27dff4285c45a8b11b57061c78639092154713.execmd.exedescription pid process target process PID 2680 wrote to memory of 1264 2680 1d6463170b7e71234a1fe0ddde27dff4285c45a8b11b57061c78639092154713.exe cmd.exe PID 2680 wrote to memory of 1264 2680 1d6463170b7e71234a1fe0ddde27dff4285c45a8b11b57061c78639092154713.exe cmd.exe PID 1264 wrote to memory of 2376 1264 cmd.exe mode.com PID 1264 wrote to memory of 2376 1264 cmd.exe mode.com PID 1264 wrote to memory of 4244 1264 cmd.exe vssadmin.exe PID 1264 wrote to memory of 4244 1264 cmd.exe vssadmin.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\1d6463170b7e71234a1fe0ddde27dff4285c45a8b11b57061c78639092154713.exe"C:\Users\Admin\AppData\Local\Temp\1d6463170b7e71234a1fe0ddde27dff4285c45a8b11b57061c78639092154713.exe"1⤵
- Drops startup file
- Adds Run key to start application
- Drops desktop.ini file(s)
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2680 -
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:1264 -
C:\Windows\system32\mode.commode con cp select=12513⤵PID:2376
-
C:\Windows\system32\vssadmin.exevssadmin delete shadows /all /quiet3⤵
- Interacts with shadow copies
PID:4244
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4212